BRAND NAME JUSTIFICATION AND APPROVAL (customer).pdf

MEMORANDUM FOR RECORD Directorate of Contracting - West Point, NY

SUBJECT: Brand Name Justification & Approval Statement

REF: PR# 0011788207 / Mission Installation Contracting Command (MICC)

1. NAME AND / OR DESCRIPTION OF ACTION BEING APPROVED:

This is a new requirement for The Army Cyber Institute (ACI) to access the GitHub Enterprise

Educational Bundle (Digital Platform) from 6/13/22 thru 6/12/23.

2. DESCRIPTION OF REQUIREMENT TO MEET THE AGENCY’s NEEDS:

GitHub provides integration of the Security Assertion Markup Language (SAML), which allows

Microsoft Office 365 authentication. This is crucial for West Point because it allows authentication and authorization of all users by using a Single Sign-On (SSO) capability. It provides West Point with the ability to easily control who has access to all West Point data stored within the GitHub cloud by restricting access based on a need-to-access. It also provides an expansion capability, if needed, to allow for automated source code review and security testing, which is required by the Software and

Development Secure Technical Implementation Guide (STIG) for performance by all Department of

Defense (DoD) software developer groups. Moreover, GitHub provides numerous methods for accessing their repositories to include the “Git” protocol as well as web-based file access and secure shell (SSH) access. The solutions provided through GitHub will provide access to unlimited source code and data file repositories under the control of West Point with tailored security permissions. This requirement aligns with the West Point Cybersecurity policy guidance under USMA Regulation 25-2.

3. SUPPORTING AUTHORITY AND / OR RATIONALE:

FAR 13.106-1(b)(1): For purchases not exceeding the Simplified Acquisition Threshold (SAT), contracting officers may solicit from one source if the contracting officer determines that the circumstances of the contract action deem only one source reasonably available (e.g. urgency, exclusive licensing agreements, brand name, or industrial mobilization).

4. REASON(S) FOR AUTHORITY CITED:

This is a Brand Name requirement that can only be purchased from GitHub Inc. The vendor does not allow third parties to sell access their digital platform. Similar alternatives were evaluated, such as

Microsoft Azure and DevOps, but they do not provide the same types of capabilities. Microsoft Azure, for example, does not support the universally recognized “Git” protocol, nor does it support unlimited data repositories with unlimited CI/CD pipeline executions. As for DevOps, it does not support unlimited users under a single firm-fixed price without multi-variable charges for each independent user, making them impossible for the Government to use as a potential source. West Point also does not have the manpower or infrastructure necessary to host this type of capability locally. The GitHub Enterprise

Education Platform does not have these limitations as the capability is cloud based and can be managed by a small number of users. The security requirements and uptime requirements are handled by GitHub and Microsoft instead of placing the burden on West Point. Therefore, market research supports this requirement in no other method than Brand Name and unrestricted.

Digitally signed by

DEAN.ERIK.STEVE.1282184288

Date: 2022.05.17 22:57:15

-04'00'

5. ANY OTHER FACTS SUPPORTING THE JUSTIFICATION:

N/A

6. DETERMINATION BY THE CONTRACTING OFFICER THAT ANTICIPATED COSTS

TO THE GOVERNMENT WILL BE FAIR AND REASONABLE:

This determination will be made through the review of competitive pricing, published price list, GSA

Schedules, previous purchases, or DoD IDIQ contracts through mandatory government sources. Based on this approach, the Contracting Officer anticipates that a fair and reasonable price will be obtained.

7. A STATEMENT OF ACTION(S), IF ANY, TO REMOVE OR OVERCOME BARRIERS TO

COMPETITION IN THE FUTURE:

The Federal Government will continue to solicit businesses until it finds one that can meet our requirements or has the ability to adjust its digital platform to meet our requirements without the conflicts, issues, or adjustment restrictions as described in Section 2 above.

8. TECHNICAL AND REQUIREMENTS PERSONNEL CERTIFICATION:

The supporting data is the responsibility of the technical or requirements personnel which form the basis for the justification. I hereby certify the statements stated above as accurate and complete.

TECHNICAL APPROVING AUTHORITY